Found hooked up to my router • Hacker News Board

Re: Found hooked up to my router

#161

Post by mynegation » Fri, Sep 28, 2018, 2:06 AM UTC

illumin8 wrote: post #143

badwolf wrote: post #123

Earlier quoted context omitted.

This is why I keep a large supply of "USB Condoms" (little dongles that short circuit the data, and allow charging/power only)

Product idea: internal condoms for every USB port on a business computer. Let employees charge their phones in USB ports or plug whatever in, data wires never connect - problem solved: Employees can charge their ${device} without risking security compromise of the host workstation.

Which is totally redundant because that can be done on operating system level, but hey, bottled water is a huge industry too.

Re: Found hooked up to my router

#162

Post by implying » Fri, Sep 28, 2018, 2:09 AM UTC

ttty wrote: post #155

amckinlay wrote: post #115

Earlier quoted context omitted.

I still don't understand how this device could steal login details. Everything should be encrypted and authenticated through PKI when using any website that accepts login details. Whenever I visit a website with an expired certificate, for example, Chrome gives me a big red warning banner before allowing me to continue to the site.

For example you can go to my http://website.com now the normal website has a HTTPS redirect on home page. Your router replaces that page and disables the redirect. Now is up to you to notice you're on a http connection. If you think is rare, I can tell you some fortune 500 FX and stocks trading have this vulnerability a year ago (didn't checked again).

This is why certificate pinning and modern web security practices are so important. On a well configured site, this attack would fail.

Re: Found hooked up to my router

#163

Post by deytempo » Fri, Sep 28, 2018, 2:12 AM UTC

Merad wrote: post #106

qualsiasi wrote: post #30

If someone would ship this to our office with a note like "attach this to a LAN port" chances are it will get attached. And we're a software house. People tend to pay attention to viruses, etc.. but not physical security.

At a previous employer (Fortune 500, not a software co.) the IT security team would sometimes seed the parking lots with thumb drives that were "infected" with a program that would phone home to them if plugged into a PC on the corporate network. IIRC there was a depressingly high (> 50%) rate of them being plugged in.

I’m not sure I understand what the big deal is unless your machine tries to run software automatically from devices that are plugged into it. If you plug something into a centOS machine it’s not going to be able to do anything until you mount it and even then why would code be able to run from it?

Re: Found hooked up to my router

#164

Post by astronautjones » Fri, Sep 28, 2018, 2:12 AM UTC

tedunangst wrote: post #10

ghaff wrote: post #7

Earlier quoted context omitted.

I don't think it is. Here's another thread which may be for the same thing or something similar. https://www.reddit.com/r/Scams/comments/2vd1g8/scam_rentyour... It's apparently a "rent a Facebook account" scam. (The roommate apparently also provided his Facebook credentials.)

That is 10x more informative.

It's also three (!) years old, which is crazy to think someone has been mailing these out and running the same scam on FB without getting caught, particularly from 2016 on, with the scrutiny placed on FB's illegitimate political ads

Re: Found hooked up to my router

#165

Post by sjwright » Fri, Sep 28, 2018, 2:13 AM UTC

illumin8 wrote: post #143

badwolf wrote: post #123

Earlier quoted context omitted.

This is why I keep a large supply of "USB Condoms" (little dongles that short circuit the data, and allow charging/power only)

Product idea: internal condoms for every USB port on a business computer. Let employees charge their phones in USB ports or plug whatever in, data wires never connect - problem solved: Employees can charge their ${device} without risking security compromise of the host workstation.

How is that better than epoxy squirted into all unused ports of your existing computers while also distributing fast charging USB wall warts across the office like confetti? Even the good ones are relatively cheap, especially if bought in bulk. Relative to the cost of a desktop computer they're practically free.

(I'm genuinely surprised that the standard DELL and HP corporate workstation doesn't have its front USB ports deleted and its rear port access covered by a lockable metal cowl.)

Re: Found hooked up to my router

#166

Post by deytempo » Fri, Sep 28, 2018, 2:14 AM UTC

adamconroy wrote: post #82

jeffmcjunkin wrote: post #75

Earlier quoted context omitted.

It could use something like bdfproxy[1] to intercept HTTP-downloaded EXE files, then add some persistent malware in _addition_ to whatever the EXE was doing. This has been done before, over Tor[2]. The malware doesn't have to add a new root certificate, either, though that's completely possible. The Zeus trojan [3] does "man-in-the-browser" to intercept banking information, for example. [1] https://github.com/secrets…

so the spoofer distributing these devices is going to all this trouble/expense/risk in the hope there is a http downloaded exe it can corrupt, then hopes the hashing doesn't fail on that corrupt exe, and hopes the user ignores the untrusted source warning so that it can install a trojan?

If you download putty, it comes from an http link. Try it right now

Re: Found hooked up to my router

#167

Post by sjwright » Fri, Sep 28, 2018, 2:16 AM UTC

Merad wrote: post #106

qualsiasi wrote: post #30

If someone would ship this to our office with a note like "attach this to a LAN port" chances are it will get attached. And we're a software house. People tend to pay attention to viruses, etc.. but not physical security.

At a previous employer (Fortune 500, not a software co.) the IT security team would sometimes seed the parking lots with thumb drives that were "infected" with a program that would phone home to them if plugged into a PC on the corporate network. IIRC there was a depressingly high (> 50%) rate of them being plugged in.

So these IT genuises at a Fortune 500 company were clever enough to test their employees' computer security acumen (and get the predicted result) but they weren't clever enough to simply block all use of USB mass storage devices on their corporate operating system distribution?

Surely by now all corporate desktops should be configured to not respond to any USB devices other than the generic HID for mouse and keyboard, plus a whitelist of approved devices (e.g. fingerprint readers, Yubikeys). Inserting a USB mass storage device into a corporate workstation should result in nothing. Plug-and-play shouldn't be triggered. The mass storage driver should not load.

Re: Found hooked up to my router

#168

Post by Zee2 » Fri, Sep 28, 2018, 2:17 AM UTC

krn wrote: post #144

Pxtl wrote: post #138

Earlier quoted context omitted.

How is that even possible? How does it capture keystrokes (unless you mean Google searches where each key is sent for autocomplete). How does it break SSL?

I think that by "every keystroke" he meant "every network packet".

Which would capture passwords in plaintext sent from the user side, no?

Re: Found hooked up to my router

#169

Post by wepple » Fri, Sep 28, 2018, 2:18 AM UTC

deytempo wrote: post #163

Merad wrote: post #106

Earlier quoted context omitted.

At a previous employer (Fortune 500, not a software co.) the IT security team would sometimes seed the parking lots with thumb drives that were "infected" with a program that would phone home to them if plugged into a PC on the corporate network. IIRC there was a depressingly high (> 50%) rate of them being plugged in.

I’m not sure I understand what the big deal is unless your machine tries to run software automatically from devices that are plugged into it. If you plug something into a centOS machine it’s not going to be able to do anything until you mount it and even then why would code be able to run from it?

Well for starters, if you’re curiously plugging it in, you’re going to mount it aren’t you?

Second, it can emulate an HID keyboard device and type keystrokes faster than you can react and pull it out, at which point it’s far too late - it’s pulled a secondary payload down or mounted a USB mass storage device and you’re owned.

Re: Found hooked up to my router

#170

Post by alangpierce » Fri, Sep 28, 2018, 2:20 AM UTC

empath75 wrote: post #90

adamconroy wrote: post #63

I don't see how this 'man' in the middle could actually intercept passwords, except for http, but who runs auth over http anyway. For https, the 'man' would have to substitute its own certificate and then the browser / client software wouldn't trust the cert/domain combination without the end user being extremely stupid (and knowledgeable enough to achieve the stupidity).

What are the odds that someone dumb enough to install this would be scared off by an insecure site warning?

I think Chrome for a while has simply refused to let you visit a page when there's an SSL problem (at least for certain types of problems), which seems like a reasonable solution to the "people will just ignore warnings" problem.